MalwareUsed by 1 actor

DoubleZero

DoubleZero is a destructive .NET wiper written in C# and used in attacks against Ukrainian organizations during the early phase of Russia’s full-scale invasion of Ukraine. It has been tracked by CERT-UA as UAC-0088 and is widely documented as one of several wiper families deployed against Ukrainian targets in 2022.

The malware is heavily obfuscated and is designed to corrupt files, damage registry data, and render Windows systems unbootable. Its core wiping behavior relies on the NTFS FSCTL_SET_ZERO_DATA control path via NtFsControlFile to overwrite targeted content with null bytes. A commonly noted characteristic is that it can corrupt files by zeroing only the first 4096 bytes, a speed-optimized destructive technique sufficient to make many files unusable. It also includes a secondary file-wiping routine using standard .NET file operations. Beyond user data, DoubleZero targets boot-related components and registry structures associated with Windows startup, including boot configuration data, so that affected hosts may fail to boot after restart.

DoubleZero enumerates logical drives, traverses volumes for files matching targeted patterns, and interacts with file permissions and ownership to maximize destructive reach. Reported behavior includes attempts to obtain elevated privileges such as backup, restore, take-ownership, and shutdown rights, modification of access controls on targeted files and registry keys, recursive deletion of registry subkeys, and termination of the LSASS process before shutdown or reboot. Some reporting also notes logic to avoid execution on domain controllers or to alter behavior depending on privilege level, with reduced impact when administrative rights are unavailable.

The malware targets Windows environments and has been associated specifically with Ukrainian enterprises and critical infrastructure during wartime disruptive operations. Public reporting links it to broader Russian-aligned destructive activity in Ukraine, though high-confidence attribution at the malware-family level is generally limited to its tracking under UAC-0088 rather than a universally agreed named state actor. Delivery has been observed via ZIP archives using lure-themed filenames, and some assessments indicate the wiper may also have been manually executed after attackers had already obtained privileged access to victim systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAC-0088

UAC-0088 (DoubleZero)

via cip gov uacip.gov.ua

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

eSentire Threat Intelligence assesses with medium confidence that the threat actor(s) was able to gain access to the infected machine(s) and escalate, or use, the existing administrative privileges to manually execute the malware.

Execution

1 technique

T1106Native APIEvidence1

Platform Invoke (P/Invoke) enables the managed codes in .NET to call the unmanaged functions. Calling the lower level APIs directly is a well known anti-analysis technique to evade API hooking by sandbox.

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1112Modify RegistryEvidence3

Malware then deletes the Windows registry tree subkeys in HKU, HKLM

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

T1548.002Bypass User Account ControlEvidence1

To achieve the full-scale disruption, the threat actor(s) would need to escalate their privileges or bypass the user account control (UAC) to fully compromise the system.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence3

It also interleaves random code among actual operations, together with flattened control flow, to make the code harder to follow.

T1070.004File DeletionEvidence2

The executables need to be run as an Administrator for it to gain the full access to the system files and registry keys to proceed with deletion/wiping process.

T1078Valid AccountsEvidence1

Defense Impairment

2 techniques

T1112Modify RegistryEvidence3

Malware then deletes the Windows registry tree subkeys in HKU, HKLM

T1222File and Directory Permissions ModificationEvidence1

For each file that is deemed "safe" to destroy... the wiper will: Change the access control of files by giving the Local System Account (WellKnownSidType.LocalSystemSid) full control of the file.

Discovery

5 techniques

T1012Query RegistryEvidence1

The sample enumerates the HKEY_CURRENT_USER, HKEY_USERS, HKEY_LOCAL_MACHINE registry keys including HKEY_LOCAL_MACHINE\BCD00000000... to remove them later.

T1057Process DiscoveryEvidence3

However, the wiper does kill any process named lsass.

T1082System Information DiscoveryEvidence1

The malware gets the root drive of the infected device and Operating System information using Environment.SystemDirectory and Environment.OSVersion properties.

T1083File and Directory DiscoveryEvidence3

The regular expression function imported by System.Text.RegularExpressions is used to locate certain files by patterns.

T1120Peripheral Device DiscoveryEvidence1

DoubleZero attempts to get all logical drives on the infected computers.

Impact

5 techniques

T1485Data DestructionEvidence12

Many entries concern “CaddyWiper”, “new data wiper hits Ukraine”, “destructive wiper malware”, and Sandworm operations using CADDYWIPER alongside INDUSTROYER2.

T1489Service StopEvidence2

However, the wiper does kill any process named lsass.

T1529System Shutdown/RebootEvidence3

These privileges are used to ensure the wiper has the access right to destroy the target file and reboot the system after all the actions are done.

T1561.001Disk Content WipeEvidence2

The corpus contains multiple technical analyses of wiper malware and “The Anatomy of Wiper Malware” focused on destructive techniques.

T1561.002Disk Structure WipeEvidence1

The DoubleZero wiper, for instance, only erases the first 4096 bytes of targeted files... The Azov wiper also implemented a somewhat more optimized wiping process. It does not remove all data in each file. Instead, it only targets 666 bytes in an alternating pattern...

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

17 SOURCESView more in app

trellix blogNews

May 19, 2026

Pouring Acid Rain

Mentioned in a list of wipers observed after AcidRain.

sentinelone labsNews

Jan 9, 2025

AcidRain | A Modem Wiper Rains Down on Europe | SentinelOne

Wiper malware targeting Ukraine, mentioned as one of several destructive strains active during the invasion period.

picus security blogNews

Nov 13, 2023

October 2023: Key Threat Actors, Malware and Exploited Vulnerabilities

Named as a wiper used in destructive campaigns (mentioned as part of a Russian wiper arsenal).

fortinet threat researchNews

Jan 24, 2023

The Year of the Wiper | FortiGuard Labs

Wiper optimized for speed by corrupting only the first 4096 bytes of files, rendering them impractical to restore at scale.

+13 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DoubleZero